The covered entity (CE), University of Virginia Medical Center, reported that an unauthorized third party may have been able to view 1,882 patients’ protected health information (PHI) on a physician's laptop computer and other devices from May 3, 2015, through December 27, 2016, by using malware. The FBI confirmed that the third party did not download files to his own machines and was apprehended. The types of PHI involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed a copy of the CE’s current risk assessment, as well as all policies and procedures concerning the issue at hand. Following the breach, the CE implemented additional safeguards for remote access to the CE’s health system network. OCR obtained assurances that the CE implemented the corrective actions listed.
